Enter Sandbox: Google is building an internet without cookies

https://www.pressgazette.co.uk/death-of-third-party-cookies-sandbox-google/

by wolverine876 • 6 years ago

157 165 6 years ago

pressgazette.co.uk

SimeVidas• 6 years ago

Contextual ads don’t need cookies. The sooner publishers realize that, the better for them.

AznHisoka5• 6 years ago

If I'm reading an article about the pandemic, I probably don't want to see ads selling me face masks. If I'm reading an article about the inauguration, I probably don't want ads selling me inauguration t-shirts.

I am however more likely to click on ads selling me home renovation stuff because they know I've recently bought something in Home Depot. Even though I'm not currently on a home renovation website.

dkdk8283• 6 years ago

I have never clicked on an ad and bought something.

thaeli• 6 years ago

The most effective ads on me, in terms of intentional click through rate (not going to count predatory clicks) are contextual ads on specialized sites. This doesn't work well for general stuff like news sites, but webcomics that do their own ads, or a super focused forum like candlepower or head-fi? Contextual ads are ideal there.

Second most effective are platform-specicic hypertargeted ads, such as Facebook ads. Lot of misses there too, but their first party targeting is good to the point of actually giving me some interesting content.

In practice the third party "contextual" ads mostly are misses for me. Wow, another ad for the home improvement thing I either researched and bought last month, or that I was looking up on a whim and don't have any intention of actually purchasing.

mcbits• 6 years ago

Maybe some articles just shouldn't have ads at all. That would be refreshing. Sites publishing ad-supported content obviously need to put the ads somewhere, but that doesn't mean every single article needs its own revenue stream to justify its existence.

ubercow132• 6 years ago

You've just given two bad examples, contrasted with one good example, to prove your point. Pick a good example of a contextual ad and a bad example of a personalised ad (there are many) and the proof is reversed.

cblconfederate• 6 years ago

They do. You can turn off personalized ads in adsense, but it still requires cookie consent

tsimionescu2• 6 years ago

There is nothing your client can do (other than blocking ads entirely) that would stop a company from serving you car ads on a car site - that's contextual ads.

Personalized ads are the opposite - you're browsing a fashion site, but you'll get car commercials because you've been visiting car commercials lately.

Nextgrid• 6 years ago

That’s an implementation issue. There’s no technical reason why a non-targeted ad needs tracking other than Google still trying to stalk people.

soared7• 6 years ago

Targeting is a piece of the puzzle. As an advertiser I need frequency capping, brand safety, page quality, geo, etc. Ignoring all that.. I still need to measure results.

hn_throwaway_992• 6 years ago

Yet somehow advertising existed for decades without being able to completely track the full path from viewed ad to purchase.

Seriously, the completely f'd up view of advertisers ("Ads won't work unless I can basically track everything about you!!") shows how bonkers the world has become. If your job can't exist without in-depth tracking of how a shown ad influences purchasing behavior, maybe your job shouldn't exist.

Seriously, ads would work plenty well enough by just showing the same ads to all users based on the contents of the page (or search query). Honestly, I'd be all for a legal framework that completely outlaws any "personalization" on the internet unless a user clearly and optionally opts in.

cratermoon11• 6 years ago

Everyone in adtech, except perhaps Google, is worried. One non-Google player I know is seriously concerned about what the cookie-less web means or online ads. Essentially the entire online advertising industry, both publishers and advertisers, is built on 3rd-party cookies.

The goal: to show you only ads for things you care about and are likely to buy and be influenced by advertising for, is good. But the reality is a mess.

Some of the downsides of Google's proposal are obvious, given its position, but there's at least one downside that users might notice: lots more ads targeted only by the demographic of the publication, making the web look more like print media or TV and presenting you and me with a lot more space on our screens wasted showing ads for things you don't care about.

As for the "fingerprinting" proposals? Bad. Very Bad. Think digital "facial" recognition bad.

tonyedgecombe• 6 years ago

The goal: to show you only ads for things you care about and are likely to buy and be influenced by advertising for, is good.

No, that's bad. The last thing I want is to be influenced by adverts.

tomComb• 6 years ago

I'd rather be influenced by relevant ads that could possibly be useful than ones that will just annoy me.

And I'd rather not make ads less effective because that would mean either more ads or fewer publishers.

tsimionescu2• 6 years ago

Exactly! Even for free market believers, ads are just a way of manipulating consumers so that they are less rational, and so they are a distortion of the market (in favor of the biggest players, of course, as they can spend the most on advertising).

cratermoon11• 6 years ago

News flash: you're influenced by all kinds of things you don't notice, and not all of those things are what you might consider "advertising".

freeone3000• 6 years ago

As opposed to the current advertisements, which are for... A mobile game? Another mobile game. A behavioral science app. A hyperspecific ad for a watch based on a video game I played, which would be cool but is useless because I have already bought that exact watch. An ad for an armored personnel carrier.

Please. Individual targeted ads are worse than content-based ads.

choeger• 6 years ago

Wait a second. An armored personnel carrier? What's the conversion funnel here? Do they send it to you? Do you get a discount if you equip your own personal motorized infantry battalion? Is there an update channel for anti-air?

tomjen32• 6 years ago

I fell left out because I want an ad for an armored personnel carrier - I won't need it, but at least that ad would be for something cool.

Honestly it feels like there haven't been any decent innovations in a long time. Aside from Apple producing an ARM laptop that doesn't suck I can't really think about what the last product I was excited for was.

cratermoon11• 6 years ago

I never said that the targeting was any good. I said it was a mess, just that it was supposed to be good. Believe me, advertisers are very aware of the problem of showing you ads for things you just bought and would love to stop doing it.

saalweachter• 6 years ago

I like to click on the weirdest ads I see, either because I'm curious or because I'm a sucker.

It does ... weird things to the ad targeting; I'm currently seeing ads for crystal figures that cost six figures. They're pretty, but not that pretty.

It's fascinating to me that people buy ads pointing to things that essentially no one can afford. I guess the idea is that they'll attract attention and people will click around the site to find cheaper things?

throwaway189262• 6 years ago

Advertising was around for thousands of years before tracking. The fear is that they won't make as much money and will have to go back to how they did it before all the privacy invasion. Very sad indeed.

It's easy really, you just put ads on sites visited by your target market. That's how advertising was always done before Gattica style snooping was involved.

Individually targeted advertising needs to be illegal. It's bad for society.

1propionyl3• 6 years ago

It's not unreasonable to think that a lot of current digital ad spend is 1) an arms race for slices of a pre-existing attention pie that also resembles a protection racket, 2) a huge waste of money.

There have been a couple of natural experiments showing #2 where entire digital ad spends were slashed at once with little to no impact.

As for #1, look at where a massive chunk of Google's revenue comes from: companies trying to squat their own name and similar keywords to prevent some competitor's product from showing up next to their own.

yazaddaruvala• 6 years ago

Targeted advertising through tracking is only good for “aggregators” that want infinite eye balls.

Any platforms that create content already have well targeted ads without tracking. e.g. HBO

Even on content aggregators, that target niche audiences like HN have well targeted ads without tracking. Jobs and of course Ycombinator listed everywhere.

Killing tracking kills the mega content aggregator industry (front page of Reddit, maybe Facebook feed, etc) but this is likely a good thing.

1propionyl3• 6 years ago

...there's at least one downside that users might notice: lots more ads targeted only by the demographic of the publication, making the web look more like print media or TV...

...this is bad? Sounds great to me.

...showing ads for things you don't care about.

This is what targeted advertising already accomplishes: showing me ads for things (or equivalents of things) I already own. Either that or things so wildly off base I have to wonder if the targeting works at all.

cratermoon11• 6 years ago

Yes, advertisers would love to stop showing you ads for things you just bought. If you see a wildly off base ad, it's likely not targeted, it's just part of an ad buy.

Targeting only by the demographic of the publication is not so great because publishers usually only have a vague idea who their actual demographic is. Take for example the TV show Golden Girls. It was supposedly all about the 50+ demographic, but it was a huge with with queer people of all ages right from the start.

konjin2• 6 years ago

presenting you and me with a lot more space on our screens wasted showing ads for things you don't care about.

As opposed to the ads for toilet seats from that one time I bought a toilet seat online 6 months ago.

If anything forcing adds to be dumb will mean that we get high quality publications in niches again. If you sell model ships advertising on model-ships-magazine.com actually incentivizes a quality site that is interested in furthering the hobby and keeps your dumb smart ads from clogging up the rest of my life.

toper-centage• 6 years ago

Time for everyone in adtech to start advertising Firefox then. Google has made it clear they want to be the only platform where users can watch ads. OSes, Browser, websites.

TLightful2• 6 years ago

Good.

May be the most important thing google have done in decades.

Granted. Ive not read the article, so this could be a steaming pile of ... but I'm hopeful.

BayAreaEscapee• 6 years ago

I often find that the HN comments are more helpful than the article itself. If I read a bit of an article and it doesn't get to the point quickly, I just close it and start reading the HN comments.

throw140820202• 6 years ago

I see whats going on here. One ignoramus to another.

birdyrooster• 6 years ago

Why wouldn’t services just proxy their vendors cookies for them via another side channel? Then voila your third party cookie problem goes away.

jedberg3• 6 years ago

The main reason is speed. It ads extra latency that kills ad response rates.

Secondly is trust. The third party has no way to verify the first party isn't sending bogus requests to increase their payments from the third party and/or hurt their competitors.

cratermoon11• 6 years ago

Ad fraud is real. It goes the other way too, the "proxy" site could serve up a different ad from the one it's supposed to be sending, and it would be hard to know.

sleavey2• 6 years ago

I've wondered this for years. It was the first thing I expected ad networks would start doing once third party cookies were getting blocked widely.

Dma54rhs• 6 years ago

Mainly a trust issue with publishers.

bpodgursky• 6 years ago

It only works if you have identified (logged-in) traffic and pass the identifier (ie, email hash) along to the side-channel.

Otherwise there's no way to target the ads, it's a first-party cookie but scoped to a single domain so there's no useful targeting data.

(and yes, this is the industry plan, but it's TBD whether publishers like media websites can get a workable fraction of their users to log themselves in)

jedberg3• 6 years ago

Ok, so basically Chrome will keep a profile on you and send that Google, so as long as the ads on the webpage are Google ads they will be targeted, but any third party provider will not be able to do the same?

Sounds like they are finally realizing their vision for making Chrome in the first place -- to sell more ads.

I'll stick with Firefox with temporary tabs -- I already an protected from third party cookies because Firefox already isolates every tab, but importantly doesn't send my browsing data anywhere.

taf2• 6 years ago

Can you provide some references to where you're seeing this. If anything they are killing off third party cookies just like Apple and Firefox. Also they are making it so even third party Javascript is less likely able to track you - meaning everything has to be first party. IMO this just means there will be a shift in how tracking works. Moving from third party tracking scripts you install on your website to using CDN's to pull code through or host on your own domain. IMO this means you'll be less able to identify when you're being tracked much more like how it works today on native apps, e.g. you can't tell whether that native app is tracking you.

jedberg3• 6 years ago

I'm making some logical leaps. They appear to be killing off 3rd party cookies just like Apple and Firefox. The difference is that Apple and Firefox do not sell an ad product and don't have a reputation for tracking your every move on the internet. Google on the other hand does have a reputation for tracking you through Chrome.

tomaszs2• 6 years ago

Google is building an internet without WWW, that is for sure:

"Because data are ultimately transferred to the same businesses, it can be used to create detailed profiles, said academics. If information from a dating app, for example, were shared with the same parent company as data from a banking app, it could be possible to deduce the sexuality of a bank’s customers." https://ig.ft.com/mobile-app-data-trackers/

uniqueid• 6 years ago

World Wide Google. If a modern person goes with the flow, they wind up using Google for every facet of their online life: OS, web browser, search, email, youtube watching, personal photos, cloud storage, DNS, address book, chat, office suite, wallet... I wouldn't entrust my best friend with all that data, let alone people over whom I have zero power and have never met.

tomaszs2• 5 years ago

It gives a really good perspective on the topic.

sleavey2• 6 years ago

What's to stop a website gradually querying different API data on each page load to build up a profile with the same amount of information as before? Will browsers only allow the first N API accesses forever more? Oh, interesting... lots of nasty mistakes can be made by websites picking a bad set of APIs early on.

However it works, I don't trust it if it's coming from Google. I'll keep my multiple layers of ad blockers enabled.

soared7• 6 years ago

Publishers are allotted a certain amount of api calls per (user?) in theory to prevent that.

duckfang• 6 years ago

There is a potential counter here by everybody not google. Run a browser string check, and redirect people to Firefox.

Google is being blatantly anticompetitive, and significantly abusing monopoly status to further monopolies elsewhere. And the govt won't come to help in any near future, so it's up to the rest of us to back them off.

(Now, why firefox? Well, its not because FF allows better tracking, but instead that nobody gets the tracking benefit. It's not a 'screw users with FF', but 'screw Goog with no metrics'.)

izacus• 6 years ago

How does redirecting people to a browser who actively blocks tracking help publishers who want to track the crap out of you? :)

throw140820202• 6 years ago

Like you rightfully implied in your last paragraph, there is no incentive for websites to ask people to go to firefox. So they won't do it.

I see companies siding with Google because they'll need to, to survive or grow, in the short run anyway.

lmkg2• 6 years ago

Google wants your Google Account to be the only Identity Signal available on the web.

This feature is available right now in Analytics and Ads. It's called "Google Signals." The documentation is publicly available, although it's a little scattered between different product page. I'll summarize:

If the user is using Chrome, and is logged into their Google Account, then you can use that instead of cookies. This is used for pulling in demographic information, cross-domain tracking, and cross-device tracking (something even 3rd-party cookies can't do without fingerprinting!).

The Privacy Sandbox kills other channels that might be an identity signal. Meaning ones available to parties other than Google.

Even as an anti-Google zealot who disapproves of this, I'll admit there are some ancillary benefits. For one, I honestly do believe that Google intends to kill fingerprinting, because it's in their interest to do so. For another, Google does offer a setting "disable personalized advertising" which will centrally let you opt-out of this tracking.

But most people are surprised when they find out that things already work this way, which to me already puts it on ethically dubious foundations from a privacy perspective. And, of course, the monopoly issue.

hrktb• 6 years ago

That’s interesting, Google

“disable personalized advertising”

On this bit, tracking concerns are not just for advertising though. Extending your reading on how they replace cookies with the Google id, I’d see them replacing ad targeting with other uses of the data anything that wouldn’t straight be labelled as “ad” (scoring, black listing, indirect target matching, etc.)

joefkelley2• 6 years ago

I'm a Google engineer who interacts a little bit with this kind of stuff.

There are a few settings for this kind of thing. You can take a look at https://myaccount.google.com/data-and-personalization

The "Ad personalization" bit is probably what the parent comment is referring to. But it sounds like you're interested in the "Web & App Activity" bit, which will turn off the non-ads usage of your data. To a certain extent at least, since there are some grey areas.

For example, I'm on the team that sends Google Shopping emails. If you click a button to track the price of a specific TV, we'll still send you an email if that price drops even if you've opted out of "Web & App Activity". But if you've just been browsing shopping pages for TVs, we won't send you a general email about TV deals if you've opted out. Both of those cases are in some literal sense "web activity" but it's still pretty clear what the user expects.

But you might imagine- if you're tracking the price of a specific TV and opted-out of Web & App Activity, should we send you an email if a near-identical TV drops in price? We probably wouldn't, and we don't have anything like this today, but it's not quite as clear. And Google has so many features across different teams, I can imagine there's probably at least one where some privacy reviewer made a different call than what you would have made.

cung• 6 years ago

An interesting thing I've noted on disabling personalized advertisements: My SO, who has personalized ads on and lives in the same household, sees ads based on my behaviour. So the ads aren't personalized to me, but they certainly are to my SO.

goliatone• 6 years ago

Depending on the type of ads being served that cross-profile-pollination could lead to info leakage and problematic and/or weird situations. It makes me want to be able to build a fake persona rather than a ghost/anonymous profile

input_sh2• 6 years ago

In other words, they're personalised to your IP address, but since only your SO has personalised ads turned on, they see what's personalised to both of you.

solarkraft• 6 years ago

Obviously that just gives Google a monopoly on tracking. So that's cool, I guess ...

uyt• 6 years ago

Centralization is not always bad. Google is a single company and can be regulated so you can opt-out.

I guess I just don't care who makes money off fingerprinting as long as I can choose that no one makes money off me personally.

wackget• 6 years ago

How do you kill fingerprinting, though? It's impossible without limiting what web developers can do with their sites.

bombcar• 6 years ago

Many ways! You reduce the nearly unlimited responses for various aspects of a defined few - such as a basic list of fonts or the nearest screen resolution. You only provide random data unless the user specifically grants fine tuned info. You stop providing long lists of capabilities and instead leave it to the implementation to assume.

Providing a “baseline” user agent instead of a detailed specific version could help for example.

cpeterso• 6 years ago

If the user is using Chrome, and is logged into their Google Account, then you can use that instead of cookies.

How is the Google Account ID shared if not by cookies?

bigiain2• 6 years ago

"Oh _these_ aren't cookies! It's just that Chrome sets and sends custom http headers to all Google owned websites. _Totally_ not cookies! _Totally_ GDPR compliant!"

Set-X-Totally-Not-An-HTTP-Cookie: sessionToken=bigiain; Expires=Wed, 17 Jan 2091 10:18:14 GMT

nahtnam• 6 years ago

I wonder if they are also doing this to get around the GDPR related cookies stuff. Don't need to have a banner if you don't use cookies. I assume this would also apply to sites using Google Analytics as well

Gwypaas• 6 years ago

GDPR is actually technology agnostic, it doesn't mention cookies or any other technology. If you store extra PII in any way, cookies, fingerprinting, localstorage or whatever you need to ask for consent with opt-in.

onion2k• 6 years ago

If the user is using Chrome, and is logged into their Google Account...

What does it do if the user isn't signed in to Google?

Google's engineers would have to have an unbelievable level of contempt for users to propose a feature that claims to improve privacy by signing in to Google.

bryanrasmussen• 6 years ago

It is a well known stereotype of programmers that they have contempt for users.

lrossi2• 6 years ago

It will probably nag you all the time like it does now for each YouTube video you open without signing in.

bigiain2• 6 years ago

Google's engineers would have to have an unbelievable level of contempt for users to propose a feature that claims to improve privacy by signing in to Google.

I, for one, find that level of contempt totally believable.

callmeal• 6 years ago

What does it do if the user isn't signed in to Google?

Well, then they just use you to train their fire-hydrant, bus, bicycle, and stair image recognition algorithms.

userbinator4• 6 years ago

"It is difficult to get a man to understand something when his salary depends on his not understanding it."

brundolf• 6 years ago

Interesting way of looking at this: monopolies stifle markets and hurt consumers. But consumers of the ad market are not the end-users, they're the companies buying ads. Therefore, by strangling the market, it is actually possible for Google to be helping people for whom that market is a bad thing (which is most of us).

soared7• 6 years ago

You are plainly ignoring the actual privacy sandbox in favor of the clickbait. Google is killing 3p cookies which kills google competitor products. But the sandbox is purpose built to create new infrastructure for the competitors (and google) to rebuild in a privacy focused way. The privacy sandbox is a way to create an alternative to IDs (like google’s sign in option) and 3rd party cookies. You can go through proposals and see how these can work here: https://github.com/w3c/web-advertising

Look, I’m not a google fan but you can’t just ignore half of what google is doing. Even then, you’re missing that they are other ID projects that are closing ground on googles ID.

i2shar• 6 years ago

This is an egregious violation of privacy of the unsuspecting Chrome user who conducts their business while signed in to Chrome.

To make things worse, couple of years ago, Chrome started mingling Chrome Sync and cookies for accounts.google.com which meant that signing into Chrome Sync also automatically signed you into all of Google services. The cookies reappear even if you delete them, just because you are signed into Chrome Sync. Now, that same identity (<you>@gmail.com) is not just used for Google's own websites, but also made available to anyone who uses Google Analytics - which is 90% of the web - including your cross-domain and cross-device history. Of course, none of this is new, but I shudder every time at the thought of how much information the user is giving away about themselves.

shostack2• 6 years ago

How is that identity made available to anyone via GA? Google does not allow user identifiable PII in GA.

Are you conflating the aggregate anonymized data in GA with the user level visibility Google has into the raw data?

hyperdimension3• 6 years ago

"Google Signals," huh.

That sure doesn't sound insidious...kind of like a large Internet ad company trying to make sure that they're the only one who can track your activity online.

Don't worry, though. If you were using any of the now-dead competing advertiser networks, you can target using this information for a small fee! They sure know how to benevolently push forward the wheel of progress to fight to ensure your absolute privacy from everyone but them.

Not that I'm a fan of these 'Signals'--or even cookies for that matter.

WhyNotHugo2• 6 years ago

The do intend to kill fingerprinting [and cookies].

But only because they have a far more efficient way of tracking users _and_ make sure they're the only one who can benefit from this.

It's unbelievable how absurdly anti-competitive and anti-consumer google has become, yet nobody seems to care.

einpoklum• 6 years ago

Another reason not to have Google profile and block them as a 3rd-party when relevant, e.g. using EFF Privacy Badger and uBlock Origin.

Also, try avoiding Chrome. At least use Chromium, preferably something else.

figgyc• 6 years ago

I think one thing overlooked is that Google's supposed rationale for providing this service is effectively because they suppose that their plans to "more aggressively block fingerprinting" will leave advertisers with no other choice.

Personally I find this highly unlikely. The very nature of fingerprinting makes it difficult to prevent without some pretty severe compromises, and it wouldn't surprise me if advertisers enter an arms race with Google instead of caving in.

Of course the economic strategy for Google to avoid that is to reduce the price/limits of this service to so low that this isn't worth doing, but if the effort Google puts into preventing fingerprinting is insufficent then this would lead to a "worst of both worlds" situation - Google gets to pseudonymously track the internet with their "privacy sandbox", and nefarious trackers/advertisers can combine that with fingerprinting to create an even more reliable picture of who's who on the Internet.

FYI, this[0] appears to be the explainer of what Privacy Sandbox actually is, and it's quite vague, presumably because the actual implementation details of this would be difficult to determine.

[0] https://github.com/michaelkleber/privacy-model

bobbydreamer• 6 years ago

So httpOnly and secure flags are not that secure in cookies.

newbie578• 6 years ago

I actually really like this idea. I trust Google the most out of all the other players, since they have the most to lose...

If Apple can have everything built around a single ID and be praised for it's ecosystem, I don't see a reason why Google shouldn't try, especially since there are people who like Google more than Apple.

0x011721• 6 years ago

Advertising company takes steps to strengthen its advertising monopoly and shoulder out the competition. News at 11.

Before you say "use firefox", ask yourself why Google donates money to Mozilla.

The other aspect of advertising company is spy company. This will give Google better ways to track users across the web. I'm sure there will be no side effects and the information will be used only for good.

vishwajeetv• 6 years ago

Unfortunately, their own single-sign on services require us to have cookies enabled for client implementations (firebase auth), that remains the only reason to keep using cookies on the webapps I build.

cccc4all• 6 years ago

Antitrust. That's it. That's the comment.

IgorPartola3• 6 years ago

The only use for cookies I can see is authentication. There are other ways to authenticate that I have used that have been way less burdened by security issues. Store an auth token in local storage and transmit it as the Authentication header for example: CSRF problems, works with whatever framework you want. Why do we still need cookies at all?

srfvtgb• 6 years ago

Can you do this without Javascript?

lima• 6 years ago

Nope.

IgorPartola3• 6 years ago

My argument is that if you need authentication, the browser should have that built in as a first class citizen. And if you don’t want it, then why set cookies?

Null-Set• 6 years ago

Cross site scripting can exfiltrate an auth token stored in local storage. An HttpOnly cookie cannot be stolen this way, and with SameSite=strict, CSRF is not an issue.

IgorPartola3• 6 years ago

If I am running code on your site as another user, I don’t really need to steal you auth token. But that is true. Which is why browsers should expand support for authentication to provide things like public key authentication, credentials/personas storage, etc. At the very least, an API to store auth tokens (and just auth tokens). Better yet, a standard login UI for logging into any given website. Even better, public key auth so that instead of logging in by typing in a username and password, you would select which persona you use from a drop down and passwords aren’t a thing. Of course that would require a robust and secure mechanism for syncing the personas/keychains across different devices and browsers.

cratermoon11• 6 years ago

Cookies are used for all kinds of session state management besides auth. Your shopping cart, for example, depends on them. Without cookies, the server would have to send the entire state of the session in each response, and the client would have to send that entire state back on every request. Cookies allow the client and server to exchange only a small token that the server can use as a key to state storage.

Even if you could shrink that state down to something reasonably small, it still introduces the problem of the client and server getting the state out of sync.

ywei34103• 6 years ago

I mean that's not really true - TCP allows a persistent connection so you could totally just keep the shopping cart for the duration of the time that the user is on the website and /not/ use a cookie.

tester756• 6 years ago

It's way easier to protect from CSRF - either via SameSite or Anti forgery tokens.

Stealing tokens via XSS is way harder to solve.

draklor40• 6 years ago

Damn. Talk about killing your competition off with a monopoly. Break up Big Google.

trident5000• 6 years ago

The company has monopolies within a monopoly at this point. The DOJ is an embarrassment with no power. Theres never been such a concentration of economic activity in corporate America in general. Even the phone companies are about one merger away from being back to their former structure.

soared7• 6 years ago

Correct. That’s why google is working with Facebook/other major players (or at least acting like it) to create solutions to the problems they’re creating.

Not working, because all the other members of the w3c group wrote an open letter saying google is abusing their power/etc.

iou• 6 years ago

Isn't this all a bit rich from a behavioural advertising company?

soared7• 6 years ago

FWIW these proposals change every month and there are weekly calls with some of the W3C group about this. Nobody in adtech actually believes 3p cookies will be gone by the claimed date.. you can’t rebuild the entire ecosystem in (now) less than a year.

soared7• 6 years ago

https://github.com/w3c/web-advertising

Has more details for a lot of the proposals.

glandium• 6 years ago

I wonder if the title is an intentional reference to Metallica's song.

Animats• 6 years ago

Firefox has been blocking third-party cookies by default since 2019. I've had them off myself for about two decades now. Google's "solution" is inferior to what Firefox has now. Google could just follow Firefox in this and turn off third-party cookies.

fouc• 6 years ago

Just another reason to keep boycotting google & chrome.

userbinator4• 6 years ago

Always have, always will... but I wonder when someday some important site refuses to service me because I'm not using an "officially supported" (i.e. approved by Big Goog) browser which may no longer run on the hardware I use. It's already started happening. How can the masses fight back against the monopoly?

kart23• 6 years ago

Faking the user agent gets me past 99% of those 'unsupported browser' warnings.

Groxx• 6 years ago

“We’re in this in-between situation where it’s really not satisfactory because you’ve got consumers not accepting cookies and no solution in place.”

Oh my. That sounds awful.

You know, I think I actually do want Google to build this into Chrome, wire it up to your Google account for nefarious purposes and/or have the whole thing turn into an example that K-anonymity doesn't work well in practice, and try to ram it down everyone's throats. Perhaps that will finally drive people away, and start up some monopoly investigations with teeth.

In the meantime, I'll keep blocking 3rd party cookies, and rejecting on-site ones when undesired.

coding123• 6 years ago

Lol, it sounds like Google is describing the experience you get when switching to FF and using DDG.

userbinator4• 6 years ago

Google is building an internet

That is the scariest thing about this. Google already has an effective monopoly on information discovery via its search engine, and is rapidly approaching one with what software people use to view information on the Internet. It controls the "web standards" and can change them rapidly with little opposition. Websites that have no business being anything but browser-agnostic, yet are usable only in the latest version of its ever-churning browser (or its not-too-different clones), are already uncomfortably common. For a lot of people, Google is "the Internet".

I don't know what the solution is. But there's definitely a problem.

https://news.ycombinator.com/item?id=25802366

permille42• 6 years ago

1. Google doesn't own or control "the internet". They can change Google Chrome however they want; so long as they are plenty of us who don't want whatever crap they are peddling we can and will continue to use the internet as it has existed for a long time.

2. Web browsing is not "the internet". I get that headlines are all about grabbing attention by basically stating overblown lies and then backtracking in the details, but come on now.

3. Cookies aren't going away. They are necessary for how a majority of websites with login/sessions work.

4. 3rd party cookies are crap, and they may well be limited by most popular browsers. That is fine and doesn't affect normal web users. It affects advertisers to some degree, but no more than adblockers do.

5. So long as Google is involved in it, they are going to try to keep advertising profitable for themselves. So whatever "it's good for everyone" nonsense they are peddling its just them trying to prevent the public from shutting down the crappy internet advertising that most of us internet users have hated since it began.

6. It doesn't sound like they are working to prevent fingerprinting. That is the direction things should go imo; we need to get rid of all ability to identify visitors period. There is no reason why anyone needs to know what websites I visit or why, and I think there are plenty of people who agree with my desire in that regard.

7. I'm on the side of those calling to abandon Google and their nonsense. They can't be trusted any more.

WhyNotHugo2• 6 years ago

so long as they are plenty of us who don't want whatever crap they are peddling we can and will continue to use the internet as it has existed for a long time.

This is why it worries me so much that so many people use Chrome (and the number seems to keep rising).

Enter Sandbox: Google is building an internet without cookies

Related Stories